fix(auth): make SessionManager.registerRefreshHook idempotent for HMR

[yahyafakhroji]

Problem

During local development, Vite HMR re-executes entry.ts on every hot reload. The sessionManager singleton survives the reload (module-scoped), but registerRefreshHook() gets called again — hitting the "already registered" guard and throwing an error that crashes the Vite error overlay, blocking the UI until a manual tab reload.

Root Cause

The registerRefreshHook() method was designed to throw on duplicate registration to prevent multiple consumers from eavesdropping on raw access tokens. However, in Vite's HMR cycle, it's the same consumer (entry.ts) re-registering — not a different one.

Fix

Make registerRefreshHook() idempotent — repeated calls replace the previous hook instead of throwing. This is safe because:

• Only one hook can be active at a time (latest wins)
• The replacement semantics match HMR expectations (new module version replaces old)
• Production behavior is unchanged (entry.ts only runs once at server start)

Changes

• app/utils/auth/session-manager.ts — remove throw guard, replace with simple overwrite
• cypress/component/session-manager.cy.ts — update test: verify replacement behavior instead of expecting throw